agent-passport-system 4.4.0 → 4.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -1
- package/dist/src/index.d.ts +8 -0
- package/dist/src/index.d.ts.map +1 -1
- package/dist/src/index.js +14 -0
- package/dist/src/index.js.map +1 -1
- package/dist/src/profiles/mcp/index.d.ts +1 -0
- package/dist/src/profiles/mcp/index.d.ts.map +1 -1
- package/dist/src/profiles/mcp/index.js +1 -0
- package/dist/src/profiles/mcp/index.js.map +1 -1
- package/dist/src/profiles/mcp/mcp-use-adapter-v1.d.ts +84 -0
- package/dist/src/profiles/mcp/mcp-use-adapter-v1.d.ts.map +1 -0
- package/dist/src/profiles/mcp/mcp-use-adapter-v1.js +52 -0
- package/dist/src/profiles/mcp/mcp-use-adapter-v1.js.map +1 -0
- package/dist/src/v2/action-reference/v2.d.ts +25 -0
- package/dist/src/v2/action-reference/v2.d.ts.map +1 -1
- package/dist/src/v2/action-reference/v2.js +32 -0
- package/dist/src/v2/action-reference/v2.js.map +1 -1
- package/dist/src/v2/offline-verifier/context.d.ts +1 -1
- package/dist/src/v2/offline-verifier/context.d.ts.map +1 -1
- package/dist/src/v2/offline-verifier/context.js +8 -0
- package/dist/src/v2/offline-verifier/context.js.map +1 -1
- package/dist/src/v2/receipt-core/composite.d.ts +68 -0
- package/dist/src/v2/receipt-core/composite.d.ts.map +1 -0
- package/dist/src/v2/receipt-core/composite.js +102 -0
- package/dist/src/v2/receipt-core/composite.js.map +1 -0
- package/dist/src/v2/receipt-core/receipt.d.ts +39 -0
- package/dist/src/v2/receipt-core/receipt.d.ts.map +1 -1
- package/dist/src/v2/receipt-core/receipt.js +63 -1
- package/dist/src/v2/receipt-core/receipt.js.map +1 -1
- package/dist/src/v2/revocation-verification/__tests__/known-answer.test.d.ts +2 -0
- package/dist/src/v2/revocation-verification/__tests__/known-answer.test.d.ts.map +1 -0
- package/dist/src/v2/revocation-verification/__tests__/known-answer.test.js +424 -0
- package/dist/src/v2/revocation-verification/__tests__/known-answer.test.js.map +1 -0
- package/dist/src/v2/revocation-verification/digest.d.ts +20 -0
- package/dist/src/v2/revocation-verification/digest.d.ts.map +1 -0
- package/dist/src/v2/revocation-verification/digest.js +58 -0
- package/dist/src/v2/revocation-verification/digest.js.map +1 -0
- package/dist/src/v2/revocation-verification/publication.d.ts +13 -0
- package/dist/src/v2/revocation-verification/publication.d.ts.map +1 -0
- package/dist/src/v2/revocation-verification/publication.js +44 -0
- package/dist/src/v2/revocation-verification/publication.js.map +1 -0
- package/dist/src/v2/revocation-verification/types.d.ts +74 -0
- package/dist/src/v2/revocation-verification/types.d.ts.map +1 -0
- package/dist/src/v2/revocation-verification/types.js +23 -0
- package/dist/src/v2/revocation-verification/types.js.map +1 -0
- package/dist/src/v2/revocation-verification/vectors/generate-vectors.d.ts +2 -0
- package/dist/src/v2/revocation-verification/vectors/generate-vectors.d.ts.map +1 -0
- package/dist/src/v2/revocation-verification/vectors/generate-vectors.js +571 -0
- package/dist/src/v2/revocation-verification/vectors/generate-vectors.js.map +1 -0
- package/dist/src/v2/revocation-verification/verify.d.ts +18 -0
- package/dist/src/v2/revocation-verification/verify.d.ts.map +1 -0
- package/dist/src/v2/revocation-verification/verify.js +204 -0
- package/dist/src/v2/revocation-verification/verify.js.map +1 -0
- package/package.json +10 -7
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/context.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,iDAAiD;AACjD,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,kEAAkE;AAClE,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,qDAAqD;AACrD,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,qBAAqB;AACrB,EAAE;AACF,iEAAiE;AACjE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,sEAAsE;AACtE,EAAE;AACF,8BAA8B;AAC9B,gEAAgE;AAChE,iEAAiE;AACjE,kDAAkD;AAClD,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,2DAA2D;AAC3D,qEAAqE;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;
|
|
1
|
+
{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/context.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,iDAAiD;AACjD,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,kEAAkE;AAClE,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,qDAAqD;AACrD,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,qBAAqB;AACrB,EAAE;AACF,iEAAiE;AACjE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,sEAAsE;AACtE,EAAE;AACF,8BAA8B;AAC9B,gEAAgE;AAChE,iEAAiE;AACjE,kDAAkD;AAClD,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,2DAA2D;AAC3D,qEAAqE;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAuBlD;;8DAE8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAA4B;IAC3D,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;CACpB,CAAA;AAmCD;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAsB,EACtB,GAAmB;IAEnB,wEAAwE;IACxE,4CAA4C;IAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAsB,EAAE,CAAA;IAChE,CAAC;IAED,sEAAsE;IACtE,8BAA8B;IAC9B,IAAI,GAAG,CAAC,uBAAuB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACpD,CAAC;IAED,qEAAqE;IACrE,qDAAqD;IACrD,IAAI,GAAG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,8DAA8D;IAC9D,IAAI,GAAG,CAAC,sBAAsB,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IAED,sEAAsE;IACtE,iCAAiC;IACjC,IAAI,GAAG,CAAC,wBAAwB,GAAG,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IACjD,CAAC;IAED,mEAAmE;IACnE,IAAI,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC7C,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,uDAAuD;IACvD,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,qEAAqE;IACrE,kEAAkE;IAClE,qEAAqE;IACrE,IAAI,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAA;IAC7D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC"}
|
|
@@ -0,0 +1,68 @@
|
|
|
1
|
+
import type { ReceiptVerificationV1 } from './receipt.js';
|
|
2
|
+
import type { CoreDecisionOutputV1, JsonValue, ReceiptV1 } from './types.js';
|
|
3
|
+
/** The decision material a verifier must hold to bind a decision to a receipt.
|
|
4
|
+
*
|
|
5
|
+
* Why the decision OUTPUT alone is not enough, since that is the obvious
|
|
6
|
+
* expectation: receipt.decision_ref is a digest over the whole
|
|
7
|
+
* DecisionRefInputV1, which is the action reference plus the four component
|
|
8
|
+
* digests. The output contributes only one of those components. Supplying just
|
|
9
|
+
* the output would make the binding check unimplementable, and an unbindable
|
|
10
|
+
* operand is exactly the substitution hole this verifier exists to close.
|
|
11
|
+
*
|
|
12
|
+
* action_ref is deliberately absent: it is taken from the receipt, so a
|
|
13
|
+
* decision built for a different action cannot bind, and the caller cannot
|
|
14
|
+
* quietly supply an action_ref that disagrees with the receipt it is checking.
|
|
15
|
+
*/
|
|
16
|
+
export interface DecisionEvidenceV1 {
|
|
17
|
+
authority_state: JsonValue;
|
|
18
|
+
policy_input: JsonValue;
|
|
19
|
+
decision_context: JsonValue;
|
|
20
|
+
decision_output: CoreDecisionOutputV1;
|
|
21
|
+
}
|
|
22
|
+
/** Per-stage outcome of the composite verification.
|
|
23
|
+
*
|
|
24
|
+
* Stages run in order and short-circuit: a stage that does not run leaves its
|
|
25
|
+
* flag false and contributes no error code, so the errors array names the first
|
|
26
|
+
* thing that actually failed rather than a cascade.
|
|
27
|
+
*/
|
|
28
|
+
export interface ReceiptWithDecisionVerificationV1 {
|
|
29
|
+
valid: boolean;
|
|
30
|
+
receipt: ReceiptVerificationV1;
|
|
31
|
+
decision_ref_present: boolean;
|
|
32
|
+
decision_ref_bound: boolean;
|
|
33
|
+
temporal_relation_valid: boolean;
|
|
34
|
+
errors: string[];
|
|
35
|
+
}
|
|
36
|
+
/**
|
|
37
|
+
* Verify a receipt together with the decision it references.
|
|
38
|
+
*
|
|
39
|
+
* Receipt verification establishes the integrity and semantics represented by the
|
|
40
|
+
* receipt. It does not authorize dispatch, consume receipt_id, enforce single-use,
|
|
41
|
+
* recheck revocation or time at dispatch, or reserve spend. Those obligations belong to
|
|
42
|
+
* the enforcement boundary.
|
|
43
|
+
*
|
|
44
|
+
* Four stages, each with its own error code:
|
|
45
|
+
*
|
|
46
|
+
* 1. `receipt_invalid` structural and cryptographic verification, delegated
|
|
47
|
+
* unchanged to verifyReceiptV1. The full sub-result is returned under
|
|
48
|
+
* `receipt` so the caller keeps the per-signature detail.
|
|
49
|
+
* 2. `decision_ref_absent` decision_ref is OPTIONAL on ReceiptV1, so a receipt
|
|
50
|
+
* that carries none cannot be checked against a decision. Passing a decision
|
|
51
|
+
* for such a receipt is an error, never a pass: silently succeeding would
|
|
52
|
+
* report a relation that was never examined.
|
|
53
|
+
* 3. `decision_ref_mismatch` the reference binding. The decision digest is
|
|
54
|
+
* recomputed through buildDecisionRefV1, the same builder that produced it,
|
|
55
|
+
* including the normalize-before-hash step, and must equal
|
|
56
|
+
* receipt.decision_ref exactly. Without this a receipt for decision A could
|
|
57
|
+
* be checked against an unrelated decision B chosen for its convenient
|
|
58
|
+
* valid_until.
|
|
59
|
+
* 4. `valid_until_not_after_issued_at` the temporal relation, checked only
|
|
60
|
+
* once the operands are known to belong together. Both timestamps are
|
|
61
|
+
* validated as exact UTC milliseconds and then compared as instants, never
|
|
62
|
+
* as strings.
|
|
63
|
+
*
|
|
64
|
+
* The binding check runs BEFORE the temporal one on purpose. A temporal result
|
|
65
|
+
* computed over an unbound pair is not evidence about this receipt at all.
|
|
66
|
+
*/
|
|
67
|
+
export declare function verifyReceiptWithDecisionV1(receipt: ReceiptV1, decision: DecisionEvidenceV1, resolveKey: (signer: string, keyId: string, issuedAt: string) => string | undefined): ReceiptWithDecisionVerificationV1;
|
|
68
|
+
//# sourceMappingURL=composite.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"composite.d.ts","sourceRoot":"","sources":["../../../../src/v2/receipt-core/composite.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE5E;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,SAAS,CAAA;IAC1B,YAAY,EAAE,SAAS,CAAA;IACvB,gBAAgB,EAAE,SAAS,CAAA;IAC3B,eAAe,EAAE,oBAAoB,CAAA;CACtC;AAED;;;;;GAKG;AACH,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,qBAAqB,CAAA;IAC9B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,kBAAkB,EAAE,OAAO,CAAA;IAC3B,uBAAuB,EAAE,OAAO,CAAA;IAChC,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,SAAS,EAClB,QAAQ,EAAE,kBAAkB,EAC5B,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAClF,iCAAiC,CAqEnC"}
|
|
@@ -0,0 +1,102 @@
|
|
|
1
|
+
// Copyright (c) 2026 Tymofii Pidlisnyi
|
|
2
|
+
// SPDX-License-Identifier: Apache-2.0
|
|
3
|
+
import { buildDecisionRefV1 } from './decision-ref.js';
|
|
4
|
+
import { isExactUtcMilliseconds, verifyReceiptV1 } from './receipt.js';
|
|
5
|
+
/**
|
|
6
|
+
* Verify a receipt together with the decision it references.
|
|
7
|
+
*
|
|
8
|
+
* Receipt verification establishes the integrity and semantics represented by the
|
|
9
|
+
* receipt. It does not authorize dispatch, consume receipt_id, enforce single-use,
|
|
10
|
+
* recheck revocation or time at dispatch, or reserve spend. Those obligations belong to
|
|
11
|
+
* the enforcement boundary.
|
|
12
|
+
*
|
|
13
|
+
* Four stages, each with its own error code:
|
|
14
|
+
*
|
|
15
|
+
* 1. `receipt_invalid` structural and cryptographic verification, delegated
|
|
16
|
+
* unchanged to verifyReceiptV1. The full sub-result is returned under
|
|
17
|
+
* `receipt` so the caller keeps the per-signature detail.
|
|
18
|
+
* 2. `decision_ref_absent` decision_ref is OPTIONAL on ReceiptV1, so a receipt
|
|
19
|
+
* that carries none cannot be checked against a decision. Passing a decision
|
|
20
|
+
* for such a receipt is an error, never a pass: silently succeeding would
|
|
21
|
+
* report a relation that was never examined.
|
|
22
|
+
* 3. `decision_ref_mismatch` the reference binding. The decision digest is
|
|
23
|
+
* recomputed through buildDecisionRefV1, the same builder that produced it,
|
|
24
|
+
* including the normalize-before-hash step, and must equal
|
|
25
|
+
* receipt.decision_ref exactly. Without this a receipt for decision A could
|
|
26
|
+
* be checked against an unrelated decision B chosen for its convenient
|
|
27
|
+
* valid_until.
|
|
28
|
+
* 4. `valid_until_not_after_issued_at` the temporal relation, checked only
|
|
29
|
+
* once the operands are known to belong together. Both timestamps are
|
|
30
|
+
* validated as exact UTC milliseconds and then compared as instants, never
|
|
31
|
+
* as strings.
|
|
32
|
+
*
|
|
33
|
+
* The binding check runs BEFORE the temporal one on purpose. A temporal result
|
|
34
|
+
* computed over an unbound pair is not evidence about this receipt at all.
|
|
35
|
+
*/
|
|
36
|
+
export function verifyReceiptWithDecisionV1(receipt, decision, resolveKey) {
|
|
37
|
+
const errors = [];
|
|
38
|
+
const base = (receiptResult) => ({
|
|
39
|
+
valid: false,
|
|
40
|
+
receipt: receiptResult,
|
|
41
|
+
decision_ref_present: false,
|
|
42
|
+
decision_ref_bound: false,
|
|
43
|
+
temporal_relation_valid: false,
|
|
44
|
+
errors,
|
|
45
|
+
});
|
|
46
|
+
// Stage 1: structural and cryptographic, unchanged.
|
|
47
|
+
const receiptResult = verifyReceiptV1(receipt, resolveKey);
|
|
48
|
+
if (!receiptResult.valid) {
|
|
49
|
+
errors.push('receipt_invalid', ...receiptResult.errors);
|
|
50
|
+
return base(receiptResult);
|
|
51
|
+
}
|
|
52
|
+
// Stage 2: the reference must be there to be bound.
|
|
53
|
+
if (typeof receipt.decision_ref !== 'string') {
|
|
54
|
+
errors.push('decision_ref_absent');
|
|
55
|
+
return base(receiptResult);
|
|
56
|
+
}
|
|
57
|
+
// Stage 3: reference binding, through the builder rather than a reimplementation.
|
|
58
|
+
let recomputed;
|
|
59
|
+
try {
|
|
60
|
+
recomputed = buildDecisionRefV1({
|
|
61
|
+
action_ref: receipt.action_ref,
|
|
62
|
+
authority_state: decision.authority_state,
|
|
63
|
+
policy_input: decision.policy_input,
|
|
64
|
+
decision_context: decision.decision_context,
|
|
65
|
+
decision_output: decision.decision_output,
|
|
66
|
+
}).decision_ref;
|
|
67
|
+
}
|
|
68
|
+
catch (err) {
|
|
69
|
+
errors.push('decision_input_invalid', err instanceof Error ? err.message : String(err));
|
|
70
|
+
return { ...base(receiptResult), decision_ref_present: true };
|
|
71
|
+
}
|
|
72
|
+
if (recomputed !== receipt.decision_ref) {
|
|
73
|
+
errors.push('decision_ref_mismatch');
|
|
74
|
+
return { ...base(receiptResult), decision_ref_present: true };
|
|
75
|
+
}
|
|
76
|
+
// Stage 4: temporal relation, on operands now known to belong together.
|
|
77
|
+
const validUntil = decision.decision_output.valid_until;
|
|
78
|
+
if (validUntil === null) {
|
|
79
|
+
// A deny decision carries no validity window, so there is no instant that
|
|
80
|
+
// could be later than issued_at. Named separately from the ordering failure
|
|
81
|
+
// because the cause and the fix differ.
|
|
82
|
+
errors.push('valid_until_absent');
|
|
83
|
+
return { ...base(receiptResult), decision_ref_present: true, decision_ref_bound: true };
|
|
84
|
+
}
|
|
85
|
+
if (!isExactUtcMilliseconds(receipt.issued_at) || !isExactUtcMilliseconds(validUntil)) {
|
|
86
|
+
errors.push('timestamp_invalid');
|
|
87
|
+
return { ...base(receiptResult), decision_ref_present: true, decision_ref_bound: true };
|
|
88
|
+
}
|
|
89
|
+
if (!(Date.parse(validUntil) > Date.parse(receipt.issued_at))) {
|
|
90
|
+
errors.push('valid_until_not_after_issued_at');
|
|
91
|
+
return { ...base(receiptResult), decision_ref_present: true, decision_ref_bound: true };
|
|
92
|
+
}
|
|
93
|
+
return {
|
|
94
|
+
valid: true,
|
|
95
|
+
receipt: receiptResult,
|
|
96
|
+
decision_ref_present: true,
|
|
97
|
+
decision_ref_bound: true,
|
|
98
|
+
temporal_relation_valid: true,
|
|
99
|
+
errors,
|
|
100
|
+
};
|
|
101
|
+
}
|
|
102
|
+
//# sourceMappingURL=composite.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"composite.js","sourceRoot":"","sources":["../../../../src/v2/receipt-core/composite.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAuCtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAkB,EAClB,QAA4B,EAC5B,UAAmF;IAEnF,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAG,CAAC,aAAoC,EAAqC,EAAE,CAAC,CAAC;QACzF,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,aAAa;QACtB,oBAAoB,EAAE,KAAK;QAC3B,kBAAkB,EAAE,KAAK;QACzB,uBAAuB,EAAE,KAAK;QAC9B,MAAM;KACP,CAAC,CAAA;IAEF,oDAAoD;IACpD,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAC1D,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACvD,OAAO,IAAI,CAAC,aAAa,CAAC,CAAA;IAC5B,CAAC;IAED,oDAAoD;IACpD,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAClC,OAAO,IAAI,CAAC,aAAa,CAAC,CAAA;IAC5B,CAAC;IAED,kFAAkF;IAClF,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,kBAAkB,CAAC;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,eAAe,EAAE,QAAQ,CAAC,eAAe;SAC1C,CAAC,CAAC,YAAY,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QACvF,OAAO,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAA;IAC/D,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QACpC,OAAO,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAA;IAC/D,CAAC;IAED,wEAAwE;IACxE,MAAM,UAAU,GAAG,QAAQ,CAAC,eAAe,CAAC,WAAW,CAAA;IACvD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,0EAA0E;QAC1E,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QACjC,OAAO,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACzF,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAChC,OAAO,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACzF,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;QAC9C,OAAO,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACzF,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,aAAa;QACtB,oBAAoB,EAAE,IAAI;QAC1B,kBAAkB,EAAE,IAAI;QACxB,uBAAuB,EAAE,IAAI;QAC7B,MAAM;KACP,CAAA;AACH,CAAC"}
|
|
@@ -5,6 +5,12 @@ export declare function isExactUtcMilliseconds(value: string): boolean;
|
|
|
5
5
|
export declare function receiptIdPayloadV1(receipt: ReceiptV1): string;
|
|
6
6
|
export declare function computeReceiptIdV1(receipt: ReceiptV1): string;
|
|
7
7
|
export declare function receiptSignaturePayloadV1(receipt: ReceiptV1, descriptor: Omit<ReceiptSignatureV1, 'value'>): string;
|
|
8
|
+
/**
|
|
9
|
+
* This entrypoint validates the standalone ReceiptV1 structure and the fields available
|
|
10
|
+
* within the receipt. It does not establish cross-document constraints involving the
|
|
11
|
+
* referenced decision, including the requirement that decision valid_until be later than
|
|
12
|
+
* receipt issued_at. Use verifyReceiptWithDecisionV1 when both artifacts are available.
|
|
13
|
+
*/
|
|
8
14
|
export declare function validateReceiptV1(receipt: ReceiptV1, requireValues?: boolean): void;
|
|
9
15
|
export declare function createReceiptV1(fields: Omit<ReceiptV1, 'receipt_id' | 'signatures'>, signers: ReceiptSignerV1[]): ReceiptV1;
|
|
10
16
|
export interface ReceiptVerificationV1 {
|
|
@@ -18,5 +24,38 @@ export interface ReceiptVerificationV1 {
|
|
|
18
24
|
}[];
|
|
19
25
|
errors: string[];
|
|
20
26
|
}
|
|
27
|
+
/**
|
|
28
|
+
* This entrypoint validates the standalone ReceiptV1 structure and the fields available
|
|
29
|
+
* within the receipt. It does not establish cross-document constraints involving the
|
|
30
|
+
* referenced decision, including the requirement that decision valid_until be later than
|
|
31
|
+
* receipt issued_at. Use verifyReceiptWithDecisionV1 when both artifacts are available.
|
|
32
|
+
*
|
|
33
|
+
* This entrypoint operates on an already-parsed object and therefore cannot detect
|
|
34
|
+
* duplicate members that may have existed in serialized JSON. For verification of
|
|
35
|
+
* serialized artifacts, use the Serialized variant.
|
|
36
|
+
*/
|
|
21
37
|
export declare function verifyReceiptV1(receipt: ReceiptV1, resolveKey: (signer: string, keyId: string, issuedAt: string) => string | undefined): ReceiptVerificationV1;
|
|
38
|
+
/**
|
|
39
|
+
* Verify a receipt from its serialized bytes.
|
|
40
|
+
*
|
|
41
|
+
* The chain is raw -> strict duplicate-rejecting parse -> the existing structural
|
|
42
|
+
* validation -> the existing cryptographic verification. Every stage after the parse is
|
|
43
|
+
* verifyReceiptV1 itself, called once and unchanged, so this adds a parser in front of
|
|
44
|
+
* the existing path rather than a second implementation of it.
|
|
45
|
+
*
|
|
46
|
+
* WHY A SERIALIZED ENTRY POINT IS NEEDED AT ALL. Rejecting a duplicate object member is
|
|
47
|
+
* a property of parsing. Once bytes have become an object the later member has already
|
|
48
|
+
* overwritten the earlier one and the evidence is gone, so verifyReceiptV1, which
|
|
49
|
+
* receives an object, cannot detect it however carefully it validates. Exposing only the
|
|
50
|
+
* object-taking form would leave JSON.parse plus verifyReceiptV1 as the easy and
|
|
51
|
+
* superficially legitimate composition, which is exactly the shape this is meant to
|
|
52
|
+
* remove.
|
|
53
|
+
*
|
|
54
|
+
* Parse failure is reported as the error code `parse_error` followed by the parser's own
|
|
55
|
+
* message, so it is distinguishable from a structural failure, which surfaces the
|
|
56
|
+
* validator's message with no code, and from a signature failure, which surfaces
|
|
57
|
+
* `signature_invalid`. That uses the existing free-form `errors` array of
|
|
58
|
+
* ReceiptVerificationV1; no shared enum or result contract was widened to carry it.
|
|
59
|
+
*/
|
|
60
|
+
export declare function verifyReceiptV1Serialized(raw: string, resolveKey: (signer: string, keyId: string, issuedAt: string) => string | undefined): ReceiptVerificationV1;
|
|
22
61
|
//# sourceMappingURL=receipt.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../../../src/v2/receipt-core/receipt.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,
|
|
1
|
+
{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../../../src/v2/receipt-core/receipt.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAA4B,kBAAkB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE1G,eAAO,MAAM,cAAc,EAAG,mBAA4B,CAAA;AAC1D,eAAO,MAAM,eAAe,EAAG,oBAA6B,CAAA;AAe5D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI7D;AAQD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAE7D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAE7D;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,GAAG,MAAM,CAGnH;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,UAAO,GAAG,IAAI,CAiChF;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,GAAG,YAAY,CAAC,EACpD,OAAO,EAAE,eAAe,EAAE,GACzB,SAAS,CAeX;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAA;IACd,gBAAgB,EAAE,OAAO,CAAA;IACzB,iBAAiB,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACxF,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,qBAAqB,CAmB9J;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAClF,qBAAqB,CAsBvB"}
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
// SPDX-License-Identifier: Apache-2.0
|
|
3
3
|
import { createHash } from 'node:crypto';
|
|
4
4
|
import { sign, verify } from '../../crypto/keys.js';
|
|
5
|
-
import { assertExactKeys, strictJCS } from './jcs.js';
|
|
5
|
+
import { assertExactKeys, parseStrictIJson, strictJCS } from './jcs.js';
|
|
6
6
|
export const RECEIPT_ID_TAG = 'APS-RECEIPT-ID-V1';
|
|
7
7
|
export const RECEIPT_SIG_TAG = 'APS-RECEIPT-SIG-V1';
|
|
8
8
|
const HEX64 = /^[0-9a-f]{64}$/;
|
|
@@ -37,6 +37,12 @@ export function receiptSignaturePayloadV1(receipt, descriptor) {
|
|
|
37
37
|
const form = { receipt: receiptWithout(receipt, 'signatures'), signer: descriptor };
|
|
38
38
|
return `${RECEIPT_SIG_TAG}\0${strictJCS(form)}`;
|
|
39
39
|
}
|
|
40
|
+
/**
|
|
41
|
+
* This entrypoint validates the standalone ReceiptV1 structure and the fields available
|
|
42
|
+
* within the receipt. It does not establish cross-document constraints involving the
|
|
43
|
+
* referenced decision, including the requirement that decision valid_until be later than
|
|
44
|
+
* receipt issued_at. Use verifyReceiptWithDecisionV1 when both artifacts are available.
|
|
45
|
+
*/
|
|
40
46
|
export function validateReceiptV1(receipt, requireValues = true) {
|
|
41
47
|
assertExactKeys(receipt, ['profile', 'receipt_id', 'receipt_type', 'issuer', 'subject_agent', 'action_ref', 'delegation_ref', 'decision_ref', 'issued_at', 'evidence_refs', 'result', 'prev', 'signatures'], ['profile', 'receipt_id', 'receipt_type', 'issuer', 'subject_agent', 'action_ref', 'delegation_ref', 'issued_at', 'evidence_refs', 'result', 'signatures'], 'ReceiptV1');
|
|
42
48
|
strictJCS(receipt);
|
|
@@ -102,6 +108,16 @@ export function createReceiptV1(fields, signers) {
|
|
|
102
108
|
validateReceiptV1(draft);
|
|
103
109
|
return draft;
|
|
104
110
|
}
|
|
111
|
+
/**
|
|
112
|
+
* This entrypoint validates the standalone ReceiptV1 structure and the fields available
|
|
113
|
+
* within the receipt. It does not establish cross-document constraints involving the
|
|
114
|
+
* referenced decision, including the requirement that decision valid_until be later than
|
|
115
|
+
* receipt issued_at. Use verifyReceiptWithDecisionV1 when both artifacts are available.
|
|
116
|
+
*
|
|
117
|
+
* This entrypoint operates on an already-parsed object and therefore cannot detect
|
|
118
|
+
* duplicate members that may have existed in serialized JSON. For verification of
|
|
119
|
+
* serialized artifacts, use the Serialized variant.
|
|
120
|
+
*/
|
|
105
121
|
export function verifyReceiptV1(receipt, resolveKey) {
|
|
106
122
|
const errors = [];
|
|
107
123
|
try {
|
|
@@ -129,4 +145,50 @@ export function verifyReceiptV1(receipt, resolveKey) {
|
|
|
129
145
|
errors.push('signature_invalid');
|
|
130
146
|
return { valid: errors.length === 0, receipt_id_valid, signature_results, errors };
|
|
131
147
|
}
|
|
148
|
+
/**
|
|
149
|
+
* Verify a receipt from its serialized bytes.
|
|
150
|
+
*
|
|
151
|
+
* The chain is raw -> strict duplicate-rejecting parse -> the existing structural
|
|
152
|
+
* validation -> the existing cryptographic verification. Every stage after the parse is
|
|
153
|
+
* verifyReceiptV1 itself, called once and unchanged, so this adds a parser in front of
|
|
154
|
+
* the existing path rather than a second implementation of it.
|
|
155
|
+
*
|
|
156
|
+
* WHY A SERIALIZED ENTRY POINT IS NEEDED AT ALL. Rejecting a duplicate object member is
|
|
157
|
+
* a property of parsing. Once bytes have become an object the later member has already
|
|
158
|
+
* overwritten the earlier one and the evidence is gone, so verifyReceiptV1, which
|
|
159
|
+
* receives an object, cannot detect it however carefully it validates. Exposing only the
|
|
160
|
+
* object-taking form would leave JSON.parse plus verifyReceiptV1 as the easy and
|
|
161
|
+
* superficially legitimate composition, which is exactly the shape this is meant to
|
|
162
|
+
* remove.
|
|
163
|
+
*
|
|
164
|
+
* Parse failure is reported as the error code `parse_error` followed by the parser's own
|
|
165
|
+
* message, so it is distinguishable from a structural failure, which surfaces the
|
|
166
|
+
* validator's message with no code, and from a signature failure, which surfaces
|
|
167
|
+
* `signature_invalid`. That uses the existing free-form `errors` array of
|
|
168
|
+
* ReceiptVerificationV1; no shared enum or result contract was widened to carry it.
|
|
169
|
+
*/
|
|
170
|
+
export function verifyReceiptV1Serialized(raw, resolveKey) {
|
|
171
|
+
let parsed;
|
|
172
|
+
try {
|
|
173
|
+
parsed = parseStrictIJson(raw);
|
|
174
|
+
}
|
|
175
|
+
catch (err) {
|
|
176
|
+
return {
|
|
177
|
+
valid: false,
|
|
178
|
+
receipt_id_valid: false,
|
|
179
|
+
signature_results: [],
|
|
180
|
+
errors: ['parse_error', err instanceof Error ? err.message : String(err)],
|
|
181
|
+
};
|
|
182
|
+
}
|
|
183
|
+
// The single narrowing point. It does NOT stand in for validation: verifyReceiptV1's
|
|
184
|
+
// first action is validateReceiptV1, the full runtime structural check, and a value
|
|
185
|
+
// that fails it returns invalid here rather than reaching any cryptographic step.
|
|
186
|
+
// A cast-free form is not expressible against the current signatures. Passing the
|
|
187
|
+
// parsed value directly is TS2345, and a single assertion is TS2352 because JsonValue
|
|
188
|
+
// and ReceiptV1 do not overlap, so the type system itself requires the two-step form.
|
|
189
|
+
// Removing the need for it would mean widening validateReceiptV1 to an assertion over
|
|
190
|
+
// unknown, which its body's direct field accesses would force a rewrite of. That is a
|
|
191
|
+
// public API decision, recorded in the handoff rather than taken here.
|
|
192
|
+
return verifyReceiptV1(parsed, resolveKey);
|
|
193
|
+
}
|
|
132
194
|
//# sourceMappingURL=receipt.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../../../../src/v2/receipt-core/receipt.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;
|
|
1
|
+
{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../../../../src/v2/receipt-core/receipt.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAGvE,MAAM,CAAC,MAAM,cAAc,GAAG,mBAA4B,CAAA;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAG,oBAA6B,CAAA;AAC5D,MAAM,KAAK,GAAG,gBAAgB,CAAA;AAC9B,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,MAAM,GAAG,+CAA+C,CAAA;AAC9D,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7F,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;AAEpH,SAAS,eAAe,CAAC,CAAgB,EAAE,CAAgB;IACzD,OAAO,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAgD,EAAE,CAAgD;IAC3H,OAAO,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAA;AAC1E,CAAC;AAED,SAAS,cAAc,CAAwC,OAAkB,EAAE,GAAG,IAAS;IAC7F,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAA6B,CAAA;IACtD,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,OAAO,IAA0B,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAkB;IACnD,OAAO,GAAG,cAAc,KAAK,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,EAAE,CAAA;AAC/F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAkB;IACnD,OAAO,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAkB,EAAE,UAA6C;IACzG,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACnF,OAAO,GAAG,eAAe,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAA;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAkB,EAAE,aAAa,GAAG,IAAI;IACxE,eAAe,CAAC,OAA6C,EAC3D,CAAC,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAClL,CAAC,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,WAAW,CAAC,CAAA;IAC1K,SAAS,CAAC,OAAO,CAAC,CAAA;IAClB,IAAI,OAAO,CAAC,OAAO,KAAK,gBAAgB;QAAE,MAAM,IAAI,SAAS,CAAC,oBAAoB,CAAC,CAAA;IACnF,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,cAAc;QAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAA;IACrJ,IAAI,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAA;IAClG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAA;IACjF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAA;IAC3H,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAA;IACnG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAA;IAC3F,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,mBAAmB,CAAC,CAAA;IAC5I,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,mBAAmB,CAAC,CAAA;IACzH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACvC,eAAe,CAAC,GAAyC,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAA;QACrI,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAA;QAC9F,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,MAAM,EAAE,CAAA;QACjD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAA;QACnF,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACrB,IAAI,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAA;IAClI,CAAC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,eAAe,CAAC,KAA2C,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAA;QAC9J,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAA;QAC/J,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAA;QAC9C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAA;QAC5E,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjB,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IAChI,CAAC,CAAC,CAAA;IACF,IAAI,aAAa,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAA;AAC7I,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,MAAoD,EACpD,OAA0B;IAE1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAA;IAC/E,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,aAAa,GAAG,CAAC,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,SAAkB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;SAChI,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,EAAE,GAAG,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAe,CAAA;IACzG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/B,KAAK,CAAC,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC5C,KAAK,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACtE,GAAG,UAAU;QACb,KAAK,EAAE,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC;KACvE,CAAC,CAAC,CAAA;IACH,iBAAiB,CAAC,KAAK,CAAC,CAAA;IACxB,OAAO,KAAK,CAAA;AACd,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAkB,EAAE,UAAmF;IACrI,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC;QAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAA;IACrI,CAAC;IACD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU,CAAA;IAC3E,IAAI,CAAC,gBAAgB;QAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACvD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;YACrE,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;YACvG,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,CAAA;YACtC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,yBAAyB,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAA;QAClI,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAA;QACrG,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAA;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAW,EACX,UAAmF;IAEnF,IAAI,MAAiB,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,gBAAgB,EAAE,KAAK;YACvB,iBAAiB,EAAE,EAAE;YACrB,MAAM,EAAE,CAAC,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SAC1E,CAAA;IACH,CAAC;IACD,qFAAqF;IACrF,oFAAoF;IACpF,kFAAkF;IAClF,kFAAkF;IAClF,sFAAsF;IACtF,sFAAsF;IACtF,sFAAsF;IACtF,sFAAsF;IACtF,uEAAuE;IACvE,OAAO,eAAe,CAAC,MAA8B,EAAE,UAAU,CAAC,CAAA;AACpE,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"known-answer.test.d.ts","sourceRoot":"","sources":["../../../../../src/v2/revocation-verification/__tests__/known-answer.test.ts"],"names":[],"mappings":""}
|